Subcontrol 5.4

[apiperCIS]

Deploy System Configuration Management Tools

Deploy system configuration management tools that will automatically enforce and redeploy configuration settings to systems at regularly scheduled intervals.

[wmunyan]

Inputs:

• The organization's configuration monitoring system
• The list of endpoints
• The inventory and mappings of secure configuration policy(ies) to the list of endpoints
• The organization's approved configuration scanning interval (at least weekly)

Operations:

• For each endpoint, obtain the configuration assessment results using Input 1
• Following the time period specified by Input 4, re-assess to obtain a comparative assessment result

Measures:

• M1 = (For each endpoint) The number of non-compliant recommendations resulting from Operation 1
• M2 = (For each endpoint) The number of non-compliant recommendations resulting from Operation 2
• M3 = (For each endpoint) The number of recommendations assessed
• M4 = The number of endpoints

Metrics:

• Initial non-compliance ratio = M1 / M3
• Subsequent non-compliance ratio = M2 / M3
• Overall compliance = (SUM from 1..M4 (M1/M3)) / M4

Assumptions:

• The assumption is that remediation/redeployment of configuration settings is occurring based on the improvement of scores over time and subsequent assessments.

[wmunyan]

Verify with Ehab's notes.

[ealshaer]

C_t (non-compliance ratio at time t )= M1(t) / M3(t) D_i (non-compliance ratio at time t for device i) = SUM_t=1_to_t=L (Ct)/L (L: number time assessment performed) Average Non-compliance ratio for all device = SUM_i=1_to_M4 D_i / M4